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Abstract 

We construct binary dynamic traitor tracing schemes, where the 
number of watermark bits needed to trace and disconnect any 
coaHtion of pirates is quadratic in the number of pirates, and 
logarithmic in the total number of users and the error probabil- 
ity. Our results improve upon results of Tassa, and our schemes 
have several other advantages, such as being able to generate all 
codewords in advance, a simple accusation method, and flexibility 
when the feedback from the pirate network is delayed. 

1 Introduction 

To protect digital content from unauthorized redistribution, dis- 
tributors embed watermarks in the content such that, if a cus- 
tomer distributes his copy of the content, the distributor can see 
this copy, extract the watermark and see which user it belongs 
to. By embedding a unique watermark for each different user, 
the distributor can always determine from the detected watermark 
which of the customers is guilty. However, several users could 
cooperate to form a coalition, and compare their differently wa- 
termarked copies to look for the watermark. Assuming that the 
original data is the same for all users, the differences they detect 
are differences in their watermarks. The colluders can then dis- 
tort this watermark, and distribute a copy which matches all their 
copies on the positions where they detected no differences, and 
has some possibly non-deterministic output on these detected wa- 
termark positions. Since the watermark does not match any user's 
watermark exactly, finding the guilty users is non-trivial. 

In this paper we focus on the problem of constructing effi- 
cient collusion-resistant schemes for tracing pirates, which in- 
volves finding a way to choose watermark symbols for each user 
(the traitor tracing code) and a way to trace a detected copy back 
to the guilty users (an accusation algorithm). In particular, we 
will focus on the application of such schemes in a dynamic set- 
ting, where the pirate output is detected in real-time, before the 
next watermark symbols are embedded in consecutive segments 
of the content. We will show that by building upon the Tardos 
scheme fS), we can construct efficient and flexible dynamic traitor 
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tracing schemes. The number of watermark symbols needed in 
our schemes is a significant improvement compared to |9|, and 
our schemes can be easily adjusted when the model is slightly dif- 
ferent from the standard dynamic traitor tracing model described 
in Elllll. 

1.1 Model 

Let us first formally describe the mathematical model for the 
problem discussed in this paper. First, some entity called the dis- 
tributor controls the database of watermarks and distributes the 
content. The recipients, each receiving a watermarked copy of 
the content, are referred to as users. We write U — {l,...,n} for 
the set of all users, and we commonly use the symbol j for in- 
dexing these users. For the watermarks, we refer to the sequence 
of watermarking symbols assigned to a user j by the vector Xj, 
which is also called a codeword. We write £ for the total num- 
ber of watermark symbols in a codeword, so that each codeword 
Xj has length £, and we commonly use the symbol / to index the 
watermark positions. In this paper we only focus on watermark 
symbols from a binary alphabet, so that {Xj), E {0, 1} for all i,j. 
The traitor tracing code, consisting of all watermark symbols for 
each user, is denoted by ^ = {Xi ,X„}. A more common way 
to represent this code is by putting all codewords Xj as rows in a 
matrix X, so that Xj j = {Xj)i is the symbol on position / of user j. 

After assigning a codeword to each user, the codewords are 
embedded in the data as watermarks. The watermarked copies 
are sent to the users, and some of the users (referred to as the pi- 
rates) collude to create a pirate copy. The pirates form a subset 
ecu, and we use c — \C\ for the number of pirates in the coali- 
tion. The pirate copy has some distorted watermark, denoted by 
y. We assume that if on some position / all pirates see the same 
symbol, they output this symbol. This assumption is known in 
the literature as the marking assumption. On other positions we 
assume pirates simply choose one of the two symbols to output. 
This choice of pirate symbols can be formalized by denoting a 
pirate strategy by a function p, which maps a code matrix X (or 
the part of the matrix visible to them) to a forgery y. After the 
coalition generates a pirate copy, we assume the distributor de- 
tects it and uses some accusation algorithm a to map the forgery 
y to some subset a{y) = C C f/ of accused users. These users are 
then disconnected from the system. Ideally C — C, but this may 
not always be achievable. 

Static schemes. We distinguish between two types of schemes. 
In static schemes, the process ends after one run of the above 
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algorithm with a fixed codelength i, and the set C is the final set 
of accused users. So the complete codewords are distributed, the 
pirates generate and distribute a pirate copy, and the distributor 
detects this output and calculates the set of accused users. In this 
case an elementary result is that one can never have any certainty 
of catching all pirates. After all, the coalition could decide to 
sacrifice one of its members, so that y = Xj for some j e C. Then 
it is impossible to distinguish between other pirates / G C \ {_/'} 
and innocent users f E U\ C. However, static schemes do exist 
that achieve catching at least one guilty user and not accusing any 
innocent users with high probability. The original Tardos scheme 
(HI belongs to this class of schemes. 

Dynamic schemes. The other type of scheme is the class of dy- 
namic schemes, where the process of sending out symbols, detect- 
ing pirate output and running an accusation algorithm is repeated 
multiple times. In this case, if a user is caught, he is immediately 
cut off from the system and can no longer access the content. 
These dynamic scenarios for example apply to live broadcasts, 
such as pay-tv. The distributor broadcasts the content, while the 
pirates directly output a pirate copy of the content. The distributor 
then listens in on this pirate broadcast, extracts the watermarks, 
and uses this information for the choice of watermarks for the 
next segment of the content. We assume that the pirates always 
try to keep their broadcast running, so we assume that if one of 
the pirates is disconnected, the other pirates will take over. Ideally 
one demands that the set of accused users always matches the ex- 
act coalition, i.e. C = C, and with dynamic schemes we can also 
achieve this with high probability, as we will see later The new 
schemes we present in this paper belong to this class of schemes. 

As mentioned earlier, we call static schemes successful if with 
high probability, at least one guilty user is caught, and no inno- 
cent users are accused. With dynamic schemes one can catch 
all pirates, so we only call such schemes successful if with high 
probability, all pirates are caught and no innocent users are ac- 
cused. This leads to the following definitions of soundness and 
static/dynamic completeness. 

Definition 1 (Soundness and completeness). Let {^,a) be a 
traitor tracing scheme, let c > 2 and let Ei , £2 G (0, 1 ). Then a 
scheme has the soundness property with parameter ei, or is called 
El-sound, if for all coalitions C CU and pirate strategies p, the 
probability of accusing one or more innocent users is bounded 
from above as 

P{C%C)<ei. 

A static traitor tracing scheme {^,0) has the static complete- 
ness property with parameters £2,c, or is called static (e2,c)- 
complete, if for all coalitions C QU of size at most c and for 
all pirate strategies p, the probability of not catching any pirates 
is bounded from above as 

p{cnc = (d) < £2. 

Finally, a dynamic traitor tracing scheme {^,(y) has the dy- 
namic completeness property with parameters £2-,c, or is called 
dynamic {e2,c)-complete, if for all coalitions C CU of size at 



most c and for all pirate strategies p, the probability of not catch- 
ing all pirates is bounded from above as 

P{C%C)<£2. 

In the following sections we will omit the c in the complete- 
ness property if the parameter is implicit. Similarly, when Ei or 
£2 is implicit, we sometimes also simply call a scheme sound or 
complete. As we will see later, in the schemes discussed in this 
paper, ei /n and £2 are closely related. We will use the notation 
Tj = ln(£2)/ln(£i/«) to denote the logratio of these error proba- 
bilities. In most practical scenarios we have £i/« < £2, so usually 
77 6(0,1). 

1.2 Related work 

The schemes in this paper all build upon the Tardos scheme, in- 
troduced in (S). This is an efficient static traitor tracing scheme, 
and it was the first scheme to achieve £1 -soundness and (£2,c)- 
completeness with a codelength of ^ = 0{c^\n{n/ ei)). In the 
same paper it was also proved that this asymptotic behaviour 
is optimal. The original Tardos scheme had a codelength of 
£ — 100c^ln(«/£i), and several improvements for the Tardos 
scheme have been suggested to reduce the constant before the 
c^ln(n/£i). We mention two in particular: the improved anal- 
ysis done in [2|; and the introduction of a symmetric score func- 
tion in Q- Combining these improvements led to even shorter 
codelength constants in |6|. For c > 2 and TJ < 1 the construc- 
tion in |6| gives codelengths of ^ < 24c^ln(n/£i), with the con- 
stant further decreasing as c increases or r\ decreases. For asymp- 
totically large c, the construction from gives a codelength of 
i= [^+(9(c"^/^)]c^ln(n/£i). The scheme from p6| and its prop- 
erties are discussed in Section|2l 

For the dynamic setting, we mention three papers. In Q a 
scheme with no probability of error was introduced, which uses 
a large alphabet size. The number of symbols needed to catch 
pirates in that scheme is £ = 0(clog2(n)), but the alphabet size 
needed is = 2c + 1 . In fl] several schemes were suggested us- 
ing a smaller alphabet of size q — c+\, with codelengths rang- 
ing from (9(c^ log2(«)) to 0(c^ + clog2(n)). In [9} the dynamic 
scheme from [4| was combined with the static scheme from 13], 
giving a dynamic scheme using a binary alphabet with a to- 
tal codelength of ^ = (9(c'*log2(n)ln(c/£i)). In the same paper 
the author suggests that using the Tardos scheme instead of the 
scheme from 1 3 1 may decrease the codelength by a factor c, thus 
possibly giving a codelength of £ = 0(c^log2(n)ln(c/£i)). As de- 
tailed later, the schemes we present here are even more efficient 
than this suggested improvement. 

1.3 Contributions and outline 

First we show that the static Tardos scheme can be extended to a 
dynamic traitor tracing scheme in a very efficient way. This dy- 
namic scheme then has a codelength of ^ = (9(c^ln(n/£i)), where 
the constant only slightly increases compared to the scheme from 
16], while with this scheme we have certainty about catching 
all pirates, instead of at least one pirate as in the static Tardos 
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scheme. These adjustments do not influence the codeword gener- 
ation of the Tardos scheme, so the codewords can stifl be gener- 
ated in advance. This is an advantage compared to the schemes 
frommiHlll. 

Since the value of c is usually not known in advance, we then 
show how to create a c-independent "universal" dynamic scheme 
that does not require c as input. The property that the code- 
words can be generated in advance is left unchanged, while the 
scheme also has several advantages with respect to flexibility, 
detailed in Section |6] The codelength of this scheme is also 
£ = (9(c^ln(n/ei)), thus improving upon the results from jJl by 
roughly a factor 0{c^) and upon the suggested improvement in |l9l 
by a factor 0{c). 

This paper is organized as follows. First, in Section |2] we 
present the construction of the static Tardos scheme with the im- 
proved analysis from ||6l. This scheme and its results will be 
used as the foundation for the dynamic Tardos scheme, which we 
present in Section[3] Then, in Section|4]we present a modification 
of the dynamic Tardos scheme when the setting is not fully dy- 
namic. In Section|5]we then present the universal Tardos scheme, 
which is an extension of the dynamic Tardos scheme that does not 
require c as input. In Section |6] we discuss the results and argue 
that our schemes have several advantages with respect to flexi- 
bility as well. Finally, in Section |7] we list some open problems 
raised by our work. 

This paper is mainly based on results from the first author's 
Master's thesis 15). 



Note that taking 5=0 (i.e. using no cutoff) leads to Fo{p) =F{p). 

2.2 Construction 

Here we describe the Tardos scheme, with parameters dc,dz,ds 
as introduced in and with the symmetric score function intro- 
duced in (71. If certain requirements on these constants are satis- 
fied, one can prove soundness and static completeness, as in iS). 

1. Initialization phase 

(a) Take the codelength as £ — d(C^ ln(n /Ci ). 

(b) Take the accusation threshold as Z = t/,cln(« /ei ). 

(c) Take the cutoff parameter as 5 = 1/ {dgc^^^). Q 

2. Codeword generation 

For each position I < i < £: 

(a) Select p, e [5,1 — 5] from the distribution function 
Fs [p) defined in (|2]l. 

(b) For each user j e U, generate the /th entry of the 
codeword of user j according to P{Xj i = \) — pi and 

3. Distribution of codewords 



2 Preliminaries: The Tardos scheme 

The results in the next sections all build upon results from the 
static Tardos scheme, so we first discuss this scheme here. Since 
the codeword generation of the schemes discussed in this paper 
all use (a variant of) the arcsine distribution, we also first describe 
this distribution below. 

2.1 Arcsine distribution 

The standard arcsine distribution function and its associated 
probability density function f{p), are given by: 



2 1 

= -arcsin(V^), = , 

n n^p{\-p) 



(1) 



This distribution function will be used in Section|5] In Sections|2] 
[3] and |4] we will use a variant of this distribution function, where 
the values of p cannot be arbitrarily close to and 1, as this gener- 
ally leads to a high probability of accusing innocent users. In fSl , 
Tardos therefore used the arcsine distribution with a certain small 
cutoff parameter 5 > 0, such that e [5, 1 — 5]. By scaling F 
and / appropriately on this interval, this leads to the distribution 
functions Fg and associated density functions /g: 

2arcsin(Y//?) — 2arcsin(\/5) 



F5{p) = 



;r — 4arcsin(\/5) 



fsip) 



(7r-4arcsin(V5))^/?(l - p) 



(2) 



(3) 



(a) Send to each user j <E U their codeword Xj = 
(Xj.i , . . . ,Xj (), embedded as a watermark in the con- 
tent. 

4. Detection of pirate output 

(a) Detect the pirate output, and extract the watermark y ~ 

iyh---,ye)- 

5. Accusation phase 

For each user j E U: 

(a) For each position 1 < i < £, calculate the user's score 
Sji for this position according to: 



'+ Vii-Pi)/P, ifXji=l,y, = l, 
^ Vp./{l-Pi) ifXji^Q,yi^l, 



(4) 



(b) Calculate the user's total score Sj{£) = '£!i=i Sji- 

(c) User j is accused (i.e. j G C) if Sj{£) > Z. 



'Previously, in (2]|^{8), it was common to parametrize the offset 5 as 5 = 
1 / {dgc). However, in (6) it was sliown that to get optimal results, 5 should scale as 
f-'^/s rather than ' . Therefore we now use convergmg 
to a non-zero constant for asymptotically large c. 
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2.3 Soundness 



2.5 Codelengths 



For the above construction, one can prove soundness and static 
completeness, provided the constants di,d^,ds satisfy certain re- 
quirements. For soundness, in 16] the following lemma was 
proved. Here h{x) = (e^ — 1 — x) /x^, which is a strictly increasing 
function from {0,°°) to (5,°°). 

Lemma 1. /|6] Lemma 1 ] Let the Tardos scheme be constructed 
as in Subsection \2.2\ Let j be some arbitrary innocent user, and 
let a > 0. Then 

where = ah{a\/d^c^^ 1^). 

Now if the following condition of soundness is satisfied, 

3 fl > : a{dz~ Kidt) > 1 > (S) 

then using the Markov inequality and Lemma [T| with this a, for 
innocent users j we get 



p{j ec)= p{Sj{£) > z) < 



< 



So the probability that no innocent user is accused is at least (1 — 
> 1 — Ci, as was also shown in \^ Theorem 3]. 

2.4 Static completeness 

To prove static completeness, in [E] the following lemma was 
used. Below, and throughout the rest of this paper, S{£) = 
HjeC^ji^) represents the total coahtion score, i.e. the sum of the 
scores of aU pirates j e C. 

Lemma 2. ^ Lemma 2 ] Let the Tardos scheme be constructed 
as in Subsection\2.2\ and let b > 0. Then 



E e 



where A/, = ^ — r^c 



i-^r-y^-bh{bVd^)c-y\ 

If the following condition of completeness is satisfied, 

3b >0: b{Xhde-d,)>ric-^^\ 



(C) 



then using the pigeonhole principle, the Markov inequality and 
Lemma|2]with this b we get 



p(c n c = 0) < p{s{£) < cz) < 



E e 



(- 

V n 



£2- 



So static completeness follows from Lemma |2] and condition jCl), 
as was also shown in ||6l Theorem 4] . 



In ||2l and Q a detailed analysis is given to go from require- 
ments ([S]) and Q to the asymptotically optimal set of parameters 
that satisfies the constraints and minimizes dc. Recall that £ = 
dec^]n{n/ei), so a smaller d( gives shorter codelengths, whereas 
the parameters t/, and dg affect only Z and 8, which have no in- 
fluence on the efficiency of the scheme. In [6] the following result 
was obtained. 

Lemma 3. Theorem 6] Let 7 = {^)^^^ ~ 0.36. The optimal 
asymptotic value for di is 



di^— + 0{c-'l^), 
the associated values for d, and dg are 

d, = Tt + 0{c-^l^), dg = --o{^\, 

7 V In c / 

and the corresponding values for a,b,?ua,?i,h are 

2 .1/^1. Inc / /Inc 

a=--0{c-^n, b=- O In 

n 9n'Y \ \ r] 

A„ = - + 0(c-'/3), A, = ^-0(c-V3). 



A direct consequence of Lemma |3] is the following corollary, 
which gives the optimal asymptotic scheme parameters for c~^oa. 

Corollary 1. [6, Corollary 1] The construction from Subsection 
\2.2\ gives an ei-sound and static {e2,c)-complete scheme with 
asymptotic scheme parameters 
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For further details on the optimal first order constants, see ||6l. 



£ ~> —c^ln{n/£i), Z -> 7rcln(n/£i), 5 -> -c 



2.6 Example 

Let the scheme parameters be given by c = 25 pirates, « = 10^ 
users, and error probabilities £1 = £2 = 10^^. Then rj = ^, and 
the optimal values of d(,d,,dg can be calculated numerically as 

de = 8.46, d, = 4.53, dg = 14.36. 

This leads to the scheme parameters 

f= 109585, Z = 2345, 5 = 5.09 • 10"**. 

So using these scheme parameters, we know that after 109585 
symbols, with probability at least 1 — £1 there are no false accu- 
sations, and with probability at least 1 — £2 at least one pirate is 
accused. In Fig. [T] we show simulation results for these parame- 
ters. The curves in the figure are the pirate scores Sj{i) for each 
pirate j e C, while the shaded area is bounded from above by the 
highest score of an innocent user, and bounded from below by the 
lowest score of an innocent user in this simulation. In Fig.fTalwe 
simulated pirates using the interleaving attack (i.e. for each posi- 
tion, they choose a random pirate and output his symbol), and in 
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(b) Scapegoat strategy 



Figure 1: Simulations of the Tardos scheme, with c = 25 colluders, (7=10 users, 
and error probabilities ei = £2 = 10^^. In Fig.[Ta|the pirates used the interleaving 
attack, whereas in Fig. llbl thev used the scapegoat strategy. In both cases, the total 
coalition score S{f.) at time £ is approximately 72000, but while in the first case 
the score is evenly divided among the pirates, in the second case one pirate takes 
all the blame. 



Fig.[Tb]they used the scapegoat strategy (i.e. one pirate, the scape- 
goat, always outputs his symbol, until he is caught and another pi- 
rate is picked as the scapegoat). With the scapegoat strategy, only 
one pirate is caught, while using the interleaving attack leads to 
many accused pirates. 



3 The dynamic Tardos scheme 

Let us now explain how we create a dynamic scheme from the 
static Tardos scheme, such that with high probability we catch all 
colluders, instead of at least one colluder The change we make 
is the following. Instead of only comparing scores with Z after i 
symbols, we now compare the scores with Z after every position 
i. If a user's score exceeds Z at any point in time, then he is 



disconnected immediately and can no longer access the content. 
His score is then necessarily between Z and Z : = Z + ^/dgc^^^ > 
Z + maXp. Xji.yi Sji- The rest of the construction remains the same, 
except for the values of d(,d^,ds, which now have to be chosen 
differently. 

3.1 Construction 

The scheme again depends on three constants d(,d;,ds- We show 
in Subsections 13.21 and 13.31 that if certain requirements on these 
constants are satisfied, we can prove soundness and dynamic com- 
pleteness. Below we say a user is active if he is not disconnected 
in the scheme. We assume that the pirates always output some wa- 
termarked data, unless all of the pirates are disconnected. Then 
the traitor tracing scheme terminates. 

1. Initialization phase 

(a) Take the codelength as = d(C^ ln(« /Ci ). 

(b) Take the accusation threshold as Z = d^c ln(n/ei ) . 

(c) Take the cutoff parameter as 5 = l/idgc'^^^). 

(d) Set initial user scores at 5^(0) = 0. 

2. Codeword generation 

For each position 1 <i < i: 

(a) Select pi e [5, 1 — 5] from Fg{p) defined in 

(b) Generate Xjj G {0, 1} using P{Xj^i = 1) = Pi- 

3 . Distribution/Detection/Accusation 

For each position I < i <£: 

(a) Send to each active user j symbol Xjj. 

(b) Detect the pirate output y,-. 

(If there is no pirate output, terminate.) 

(c) Calculate scores Sjj using 

(d) For active users j, set Sj{i) = Sj{i— 1) +Sjj. 
(For inactive users /', set Sj{i) = Sj{i— 1).) 

(e) Disconnect all active users j with Sj{i) > Z. 

In the construction above, we separated the codeword genera- 
tion from the distribution, detection and accusation. These phases 
can also be merged by generating /?,■ and Xji once we need them. 
However, we present the scheme as above to emphasize the fact 
that these phases can indeed be executed sequentially instead of 
simultaneously, and that the codeword generation can thus be 
done before the traitor tracing process begins. 

3.2 Soundness 

For the dynamic Tardos scheme as given above, we can prove the 
following result regarding soundness. 

Tlieorem 1. Consider the dynamic Tardos scheme in Subsection 
13.71 If the following condition is satisfied, 

ln(2) 



3 fl > ; a{d^ — ^ad() > 1 
then the scheme is Ci -sound. 



ln(«/ei)' 



(S') 
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To prove the theorem, we first prove a relative upper bound on 
the probabiHty that a single innocent user is accused and discon- 
nected. This bound relates the error probability in the dynamic 
Tardos scheme to the probability that the user score at time £ is 
above Z. We then use the proof of the original Tardos scheme to 
get an absolute upper bound on the soundness error probability, 
and to prove Theorem[T] Since the relative upper bound gives us 
an extra factor 2, and since the terms in ( ISl l appear as exponents 
in the proof, we get an additional term ln(2)/ln(n/ei) compared 
to (lS]l. Note that this term is small for reasonable values of n and 
£], so this only has a small impact on the right hand side of (IS^ . 
compared to (O. 

In the following we write Sj{i) = T!k=i ^jk- ^^^^ J ^'^i^ 
tive at time /, then §j{i) — Sj{i), but whereas Sj{i) does not change 
anymore once user j is disconnected, the score Sj{i) does change 
on every position even if the user has already been disconnected, 
and calculates the user's score as if he had not been disconnected. 
Similarly, we write S{i) = T.jec^jiO foi" coalitions C. Note that if 
the last pirate is disconnected at position iq < £, then Sji and Sj{i) 
are not defined for /q < i < £. 

Lemma 4. Let j ^ U be an arbitrary innocent user, let C C 
U\{i} be a pirate coalition and let p be some pirate strategy 
employed by this coalition. Then 

P{jeC)<2-P{Sj{£)>Z). 

Proof. Let us define events A and B as 

i 

A := {j eC} = {Sji£) >Z} = \J{Sj{i) > Z}, 

1=1 

B:^{Sj{£)>Z}. 

We trivially have P{A | B) = 1. For P{B \ A), note that under 
the assumption that A holds, the process {Sj{i)}f^j^ starting at 
position io = min{/ : Sj{i) > Z} <£ describes a symmetric random 
walk with no drift. So we then have P{Sj{£) > Sj{io)) = 1 /2, and 
since 5;(/o) > Z it follows that P{B | A) > 1 /2. Finally we apply 
Bayes' Theorem to A and B to get 

PIA) = I . P(B) < 2 ■ P(B). 
^ ' P{B\A) ^ ^ ' 

This completes the proof. □ 

Proof of TheoremU] First, we remark that the distribution of 
Sj{£) is the same as the distribution of the scores Sj{£) in the 
original Tardos scheme, for the same parameters £,Z, 5. From the 
Markov inequality. Lemma [T] and condition dST l it thus follows 
that 

PiS,{£)>Z)< ^<(J.) <J.. 

Using Lemma|4]the result follows. □ 



3.3 Dynamic completeness 

With the dynamic Tardos scheme, we get the following result re- 
garding dynamic completeness. Recall that here we require that 
all pirates are caught, instead of at least one, as was the case in 
the original Tardos scheme. 

Theorem 2. Consider the dynamic Tardos scheme in Subsection 
15.71 If the following condition is satisfied, 

3/,>0:W,-^,)>(r, + i^^^±^)c-^^ (C) 

then the scheme is dynamic {£2,c)-complete. 

Similar to the proof of soundness, we prove dynamic complete- 
ness by relating the error probability to the static completeness 
error probability of the static scheme from Section |2l Then we 
use the results from the static scheme to complete the proof. We 
again see a factor 2 in the relative upper bound, which again ex- 
plains the additional term ln(2)/ln(n/£i) compared to Q- The 
other term by/ds / \n{n / ei) is a consequence of using Z instead of 
Z in the proofs. Note that these two terms are small, compared to 
the first term rj . 

Lemma 5. Let C be a coalition of size at most c, and let p be any 
pirate strategy employed by this coalition. Then 

P{C%C)<2-P{S{£)<cZ). 

Proof First we remark that P{S{£) < cZ\C %C) >l /2. This is 
because if C ^ C, then S{£) < cZ, and since S{£) - S{£) = R{£) 
is a symmetrical, unbiased random walk, with probability at least 
1 /2 we have R{£) < and S{£) < cZ. Next, we use the definition 
of the conditional probability to get 

p{c g,c) <2- p{c g,c) ■ p{s{£) < cz \ c (^c) 

^2 ■ P{S{£) < cZ,C %C) <2 ■ P{S{£) < cZ). 
This proves the result. □ 

Proof of Theorem^ First, note that in the dynamic Tardos 
scheme, the only extra information pirates receive compared to 
the static Tardos scheme is the fact whether some of them are 
disonnected. This information is certainly covered by the infor- 
mation contained in the values of pi (if pirates know /?,, then they 
can calculate their scores Sj{i) themselves and calculate whether 
they will be disconnected or not). Also note that S{£) behaves the 
same as S{£) in the static Tardos scheme, where the total coali- 
tion score is calculated for all pirates and all positions, regardless 
of whether they contributed on that position or not. So if we can 
prove that even in the static Tardos scheme, and even if coalitions 
get information about the values of p,, the probability of keep- 
ing the coalition score S{£) below cZ is bounded by £2/2, then it 
follows that also P{S{£) < cZ) < £2/2. 

For the static Tardos scheme, note that the proof method for 
the completeness property does not rely on being secret. The 
only assumption that is used in that proof is that the Marking As- 
sumption applies, which does apply here. So here we can also use 
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Figure 2: Optimal values of d[ in the dynamic Tardos scheme. The dotted Hne 

2 

corresponds to the asymptotic optimal value rff = ^ « 4.93. The bold curves 
show the values of dt in the static Tardos scheme for = 1 (top) and T] = 0.01 
(bottom) respectively. The five curves slightly above each of the bold curves show 
the optimal values of df in the dynamic Tardos scheme for n/fii = 10^*, for k = I 
up to 5. Higher values of k correspond to lower values of d[. 



the proof method of the static Tardos scheme. From the Markov 
inequality, Lemma|2]and condition jCl . it thus follows that 



P {§{£) < cZ) 



< 



< 



< 



E e-"'Wc 



..-5/3 



□ 



n / 2 
Using Lemma|5]the result then follows. 

3.4 Codelengths 

The requirements dSl l and dCT l are only slightly different from 
requirements ((Sj and Q- For asymptotically large c, these dif- 
ferences disappear, and thus the optimal asymptotic codelength 
is the same as in the static Tardos scheme. In Fig. |2] we show 
the optimal values of d( in the dynamic Tardos scheme for rj — I 
and Tj = 0.01. The different curves correspond to different val- 
ues of n/ei , ranging from n /e\ = 10^ (the highest values of de) to 
n/e\ = 10'^ (the lowest values of di). 

Note that these values of di correspond to the theoretical code- 
lengths such that probability at least 1 — £1 , by time I all of the 
pirates have been disconnected. This however does not mean that 
the last pirate is caught exactly at time I, only that he is caught 
before or at time I. So in practice the number of symbols needed 
to disconnect all traitors may be below this theoretical codelength 
£, and may even decrease compared to the static Tardos scheme. 

Furthermore, if the coalition size is not known, but only an up- 
per bound on the coalition size is known, i.e. c < cq for some 
Co, then one generally uses a traitor tracing scheme that is resis- 
tant against up to cq colluders. In Q it was shown that for the 



Tardos scheme, the total coalition score S{i) ~ Y.jec^ii') always 
increases linearly in / with approximately the same slope, regard- 
less of the coalition size. More precisely, the score S{i) behaves 
as 5'(/) ~ ipL, with A ~ § only slightly depending on the coali- 
tion size c and the pirate strategy p. Since one chooses I and Z 
such that S{t} ^ gjl ^ cqZ, it follows that S{-^£) w cZ. In other 
words, to catch a coalition of size c < cq, the expected number of 
symbols needed is approximately £ — 0(—£) = 0{ccoln{n/ei)). 
So compared to the static Tardos scheme, where the codelength is 
fixed in advance at 0{cq ln(n /fii )), the codelength is reduced by a 
factor —. In particular, small coalitions of few pirates are caught 
up to (9(co) times faster. 

3.5 Example 

Let the scheme parameters be the same as in Section |276l i.e. c = 
25, « = 10^ and ei =£2 = 10^^, so that tj = |. The optimal values 
of d(,d^,ds satisfying dS^ and dcH ) can be calculated numerically 



dc = 9.00, d, ^ 4.73, ds = 13.44 

This leads to the scheme parameters 

£== 116561, Z = 2448, 5 = 1.02-10"^ 

In Fig. [3] we show some simulation results for these parameters. 
In Fig. [3a] the pirates used the interleaving attack, and in Fig. [3b] 
they used the scapegoat strategy. 

4 The semi-dynamic Tardos scheme 

In the dynamic Tardos scheme, we need to disconnect users as 
soon as their scores exceed the threshold Z. In some scenarios 
this may not be feasible, and we may only be able to disconnect 
users several positions later, say after B more symbols. This can 
have several reasons: 

• The pirates transmit their content with a small delay, so that 
there is a delay of B symbols between original broadcast and 
the corresponding pirate output. 

• Detecting the pirate output, extracting the watermark, updat- 
ing the scores and disconnecting users takes so much time 
that a user is only disconnected after B more symbols have 
already been distributed. 

For these cases, we present two different solutions. First, in Sec- 
tion 14.11 we present a scheme that achieves a codelength of at 
most £ = dec^\n{n/ei) +Bc, where de is the same as in the dy- 
namic Tardos scheme for the same parameters. For small val- 
ues of B, this means that with codelength which is only slightly 
higher than in the dynamic Tardos scheme, we can also catch all 
pirates in a semi-dynamic setting. Then, in Section[4j2]we present 
a scheme that achieves a codelength of £ — di sc^ ln(n /ei ), where 
di B increases with B. Since a small increase in de can already 
lead to a big increase in the codelength, the second scheme gen- 
erally has a larger codelength than the first scheme. Only for val- 
ues B with B > {dtB — d()cln{n/e\) — Q.{cln{n/ei)), the second 
scheme achieves a shorter codelength than the first scheme. 
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(a) Interleaving attack 
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Figure 4: Optimal values of rff g in the semi-dynamic Tardos scheme from Section 
14.21 for the parameters n = 10*, e\ = £2 = 10"'', and r] = ^. The bold curve cor- 
responds to the values of dt in the static Tardos scheme with the same parameters, 
while the six curves above this curve correspond to the optimal values of d( b for 
B = 1,2,4, 8, 16,32 respectively. The dotted line corresponds to the asymptotic 
optimal value d( = ^ « 4.93. For B = 1 we get exactly the codelengths of the 
dynamic Tardos scheme. 



therefore use the analysis from Section |3] and conclude that with 
d(C^\\\{n/ El) positions for which we calculate scores, we catch 
any coalition of size I. Since we disregarded Be positions, the 
pirate broadcast will not last longer than i = df!C^\n{n/ ei) +Bc 
positions in total, where di^^d^ and d^ are as in the dynamic Tar- 
dos scheme for the same parameters. This means that with at most 
Be more symbols than in the dynamic Tardos scheme, we can also 
catch coalitions in this semi-dynamic traitor tracing setting. 



(b) Scapegoat strategy 

Figure 3: Simulations of the dynamic Tardos scheme, with parameters c = 25, 
n = 10* and ei = £2 = 10"^. In Fig. |3a|the pirates used the interleaving attack, 
whereas in Fig. I3bl thev used the scapegoat strategy. In both cases, after less than 
95000 symbols all pirates have been caught, which is less than the theoretical 
codelength 1= 116561, and less than the codelength of the static Tardos scheme 
with the same parameters, (. = 109585. 

4.1 First scheme: I = dic^\n{n/e\) +Bc 

The first scheme is based on the following modification to the 
accusation algorithm of the dynamic Tardos scheme. Suppose a 
user's score exceeds Z after /q positions. At position /q we now 
disconnect this user. Since this user may have contributed to the 
next B symbols of the pirate output y, we disregard the following 
B positions of the watermark, and do not update the scores for 
positions i E {iq + I, . . . ,io + B}. After those positions we con- 
tinue the traitor tracing process as in the dynamic Tardos scheme, 
and we repeat the above procedure for each time a user's score 
exceeds Z. 

With this modification, the traitor tracing process on those po- 
sitions that were used for calculating scores is identical to the 
traitor tracing process of the dynamic Tardos scheme. We can 



4.2 Second scheme: i = de^BC^ln{n/£i) 

Instead of using Be more symbols, we can also try to adjust 
the analysis of the dynamic Tardos scheme to the semi-dynamic 
traitor tracing scenario. We can do this by following the proof 
methods of the dynamic Tardos scheme, and by making one small 
adjustment. The change we make in the analysis is to use Zg := 
Z + B^e^/^ > Z + BmiiXpSji{p) instead of Z = Z + ^e^/^ 
as our new upper bound for the scores of users in the proofs. This 
results in the following, slightly different condition for dynamic 
completeness: 

V ln(«/ei) / 

If some parameters de,B,dz.Bjds,B satisfy dSl ) and dC'l ), then us- 
ing these constants as our scheme parameters, we obtain a £1- 
sound and dynamic (£2 , c) -complete scheme with a codelength of 
i — d( se^\n{n/ei). In Fig.|4]we show the values of dcB for the 
parameters n = 10^, £1 = £2 = 10"^, and Tj = j, for several values 
of B. As the value of B increases, the value of d( g increases as 
well. 
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4.3 Example 

As before, let the scheme parameters be given by c = 25, n = 10^ 
and e\ = £2 = 10^^, so that r\ = \, and let us use B — For the 
first scheme, the codelength then increases by Be — 200 compared 
to the dynamic Tardos scheme, giving scheme parameters: 

£= 116761, Z = 2448, 5 = 1.02-10"^ 

For the second scheme, the optimal values of d{ s,d^^B,ds b satis- 
fying dST l and (|C"l l for B = 8 can be calculated numerically as 

diB 10.16, d,,B = 4.94, dg^B = 10.07. 

This leads to the scheme parameters 

£= 131587, Z = 2561, 5 = 1.36-10"l 

So in this case, using the first scheme leads to a shorter code- 
length. 

5 The universal Tardos scheme 

In this section we present a dynamic scheme that does not require 
c as input. The name "universal" comes from the fact that for 
the codeword generation, we now use a distribution function F 
which does not depend on c, but is a universal distribution func- 
tion that can be used for all values of c. Because of this, we can 
use the same codewords for different values of c. In particular, 
we will use the first f'"^-* = (9(c^ln(n/ei)) symbols to catch coali- 
tions of size c, for c > 2. We do this in such a way that if a 
coalition has some unknown size c, then after f '^'^ symbols, the 
probability of not having caught all members of this coalition is 
at most £2- Since we do this for each value of c, we now only 
need 0{c^\n{n/£i)) symbols to catch a coalition of size c. 

The only problem with this new codeword generation method 
is that a completely universal distribution function which is opti- 
mally efficient for all values of c does not exist. More precisely, 
the proof of soundness of the Tardos scheme requires that the cut- 
off parameter 5 is sufficiently large in terms of c, whereas for 
completeness we need that 8 approaches as c — ^ oo. One way 
to avoid this problem is the following. For generating the values 
of Pi, we use the standard arcsine distribution function from ([T]i. 
Then for any value of c we simply disregard those values pi which 
are not between the corresponding cutoff parameter 5 and 1 — 5. 
The fraction of values of p, that is disregarded can be estimated 
easily as follows: 

1 - / f{p) dp = - arcsin ( V 5 W . 

Since ^ arcsin(\/5(^) = — ^c"^/^ + (9(c"^), the right hand side 

is small and decreasing in c, so the fraction of disregarded data is 
small. 

5.1 Construction 

Basically we run several dynamic Tardos schemes simultaneously 
with shared codewords, so scheme parameters and scores now 



have to be calculated for each of these schemes, i.e. for each of 
the values of c. We introduce counters f''"' to keep track of the 
number of positions that are not disregarded, for each value of c. 
For each c we then basically run a dynamic Tardos scheme using 
the same code X until f '''^ = £^'^\ 

1 . Initialization phase 

For each c > 2: 

(a) Take the codelength as i^"^ = d'f^c'^lnin/el''^). 

(b) Take the threshold as = <l''cln(n/e{''). 

(c) Take the cutoff parameter as 5^'^' — 1 /(t/g'^c"*/^). 

(d) Initialize the user scores at 5^'^ (0) = 0. 

(e) Initialize the counters f(') at f(')(0) = 0. 

2. Codeword generation 

For each position / > 1 : 

(a) Select pi G [0, 1] from F{p) as defined in 

(b) Generate X,-,- G {0, 1} using P{Xji = 1) = Pi. 

3 . Distribution/Detection/Accusation 

For each position ; > 1 : 

(a) Send to each active user j symbol X^,. 

(b) Detect the pirate output y,-. 

(If there is no pirate output, terminate.) 

(c) Calculate scores Sj, using 

(d) For active users j and values c such that pi e [5^'', 1 — 
5(%sstsfii)=sf\i-l)+Sji. 

(Otherwise set sfii) = sf{i~ 1).) 

(e) For values of c such that pi e [S''-*,! — S*-''^], set 
fW(/) = fW(/-l) + l. 

(Otherwise set t^^^i) = f(')(/- 1).) 

(f) Disconnect all active users /' with S^j'\i) > z'''' and 

< iW) for some c. 

As was already mentioned in Section 13.11 if desired 
the codeword generation can be merged with the distribu- 
tion/detection/accusation phase. This depends on the scenario and 
the exact implementation of the scheme. 

Also note that in the above construction, no bounds on / and c 
are given. If we run the above scheme forever, we will eventu- 
ally catch any coalition of any size. In practice one may choose 
to use some upper bound cq on the size of any coalition (in the 
worst case: cq < «), and only keep scores for 2 < c < cq. In that 
case, drawing values pi from Fg(cg) also makes more sense, as val- 
ues Pi ^ [S^'^o-', 1 — S'"^"'] would be disregarded for all 2 < c < cq. 
So while the construction given above is the theoretical solution 
to catch arbitrary large coalitions, we can also construct an effi- 
cient scheme to catch coalitions of size at most cq from the above 
scheme by making these small adjustments. 
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5.2 Soundness 



5.4 Codelengths 



For the universal Tardos scheme we prove the following result 
regarding soundness. 

Theorem 3. Consider the universal Tardos scheme in Sub- 
section 15.71 If dS^ is satisfied for each set of parameters 

dz'^\d'f\dg\e[''\ and if the ej''' satisfy the following require- 
ment: 

£ £{'■'<£!, (E) 

c=2 

then the scheme is e\ -sound. 

Proof. For each c > 2, let C''^ be the set of users that are accused 
because their scores Sy exceeded Z*') before f(') > Then 
C = Ur=2C''-- For any fixed c, we can then apply Theorem [T| to 
the parameters d^^\di''\d''^\a^'^^ and ef'' so that we know that 

the probability that /' e C*^'' for innocent users j is at most el*^^ / n. 
So the probability that an innocent user is disconnected is then 
bounded from above by 

i^O-eC)<i:n/ec'^')<L^<-- 

The result then follows. □ 

Note that one can choose values e|'^' satisfying (|E]l such 

that 0{c^\n{n/e'f^)) = 0{c^\n{nl e\)), e.g. by taking e|''^ = 
6ei/(7r^c^). If furthermore = o(n), then it also follows 
that £/^'C^ln(n/e|'^') = di,c^\n{n/ E\){\ +o(l)) and we achieve the 
same asymptotic codelength as in the static and dynamic Tardos 
schemes. 

5.3 Dynamic completeness 

Theorem 4. Consider the universal Tardos scheme in Sub- 
section 15.71 If (IC'b is satisfied for each set of parameters 
di^\d'f\df ,£['\ri'^'''\ where 77W = ln(l/£2)/ln(n/ej'''), then 
for each c > 2 the scheme is dynamic {£2,c)-complete. 

Proof. This follows directly from applying Theorem |2] to 
d^f' ,d'f\d^g\a^^''^ and £f\ where c is the actual (unknown) coali- 
tion size. □ 

To prove that the scheme catches a coalition of size c, we 
only argue that the coalition's score S^'^'i (i) will exceed cZ^'^^ be- 
fore we have seen positions with 5'"^' < pi < I — 5^'^\ In 
reality, the probability of catching the coalition is much larger 
than this, since e.g. with high probability their score 5(^^-1) will 
also exceed z''^^'-' before we have seen ^'''^'^ positions with 
Pi G [S''^'^'', 1 — 5''^')]. And if a pirate is disconnected because 
his score exceeded some threshold Z^'^^ then we do not have to 
wait until S{i) > cZ^'-'^ but only until S{i) > (c- 1)Z('^^) +z(*^). And 
since S{i)/c has a constant slope, as soon as a pirate is caught, 
the other pirates' scores will increase even faster In practice we 
therefore also see that we usually need fewer than useful po- 
sitions to catch a coalition of size c. 



The theoretical results from the previous subsections are not for 
exactly f'"^' watermark positions, but for some number of symbols 
r^'^'^ such that there are positions / with /?,■ e [S''-*, 1 — S'-'^-'] 
by then. The difference T^'^ — is a random variable, and is 
distributed according to a negative binomial distribution with pa- 
rameters r = (the number of successes we are waiting for) and 
p = 1 -P{pi e 1 - = ^ arcsin(%/5W) (the probabihty 
of a success). Because the parameter p = 0{c^^^^) is very small 
for large c, the difference between r''^ and ^'^'^ will also be small. 
More precisely, T'') has mean &'> /(I - p) ^ i^'^l + 0{c-^/^)) 
and variance = £^'^''p/{l — p)^ = 0{&^c^^l^), and the proba- 
bility that r''' exceeds its mean by m > decreases exponentially 
in m. 

Also note that if some upper bound cq > c is used for construct- 
ing the scheme as described earlier, then since the values of pi are 
drawn from 7^g(rQ) we have r('^'o) = ^f''"), as no values of p, are 
disregarded for c — cq. So then the maximum codelength is fixed 
in advance, at the cost of possibly not catching coalitions of size 
c > CO. 

Finally, note that this scheme is constructed in such a way 
that coalitions of any (small) size can be caught more efficiently. 
To catch a coalition of size c we now only use 0(c^ln(«/ei)) 
symbols. This in comparison to the static and dynamic Tardos 
scheme, where we need (9(cQln(«/ei)) and 0{ccQ\\\{n / e\)) sym- 
bols respectively, where cq is again some upper bound on the 
coalition size used to construct the schemes. So while using the 
dynamic Tardos scheme already reduces the codelength by a fac- 
tor the universal Tardos scheme further reduces the codelength 
by another factor — . 

5.5 Example 

As before, let the scheme parameters be given by c = 25, n = 10*' 
and El = £2 = 10^^. Let us take cq = 25, and use 7^g(co) for 

generating values of pi. Let us also use e^y'' = 6ei/(7r^c^), 
so that Ltl2^i'' — I^r=2£i'^ — £i- The optimal values of 
df'^'' , (7p^' , d'^g^'' satisfying (IS^ and dCT l can be calculated numer- 
ically as 

df^^ = 8.59, liP' =4.61, d'f^^ = 13.83. 

For c = 25, this leads to the scheme parameters 

^(25) ^ 148457^ z(25) ^ 3J88^ g(25) ^ ^ . ^q-a 

In Fig.|5]we show some simulation results for these parameters. 
In Fig. |5a|we simulated pirates using the interleaving attack, and 
in Fig. |5b] the pirates used the scapegoat strategy. As one can 
see, in the universal Tardos scheme the scapegoat strategy is not 
a good strategy, as the whole coalition is caught sooner. 

6 Discussion 

Comparing the universal scheme to the static scheme, we see that 
the main advantages are that (a) we now have certainty about 
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Figure 5: Simulations of the universal Tardos scheme, with parameters c = 25, 
n = 10^ and £[ = £2 = 10^^. In Fig. |5a|the pirates used the interleaving attack, 
wfhereas in Fig. ISbl thev used the scapegoat strategy. For each pirate j we only 
show the score 5^'' (i) which got him disconnected. 



catching the whole coalition instead of at least one pirate, and (b) 
we no longer need the coalition size c, or a sharp upper bound on 
the coalition size as input. We do need to keep multiple scores per 
user, namely one for each possible coalition size c, so therefore in 
practice one will in fact use some upper bound cq on the coalition 
size, and keep scores for values c with 2 < c < cq for some cq. 
But since the only disadvantage of a large cq is a large number 
of scores per user (which may not be an issue), cq can easily be 
much higher than the expected coalition size. This in contrast to 
the static and dynamic Tardos schemes, where an increase in cq 
means an increase in £ as well. 

In Table [T] we list some of the differences between the static, 
dynamic, semi-dynamic and universal Tardos schemes. Here we 
assume that the upper bound cq on the number of colluders is 
the same for each scheme. The actual coalition size is denoted 
by c. The example referred to in the table is the example used 



throughout this paper, with c = cq = 25, n = 10 , and ei = £2 = 
10^^. The practical codelengths are based on 1000 simulations 
for each scheme, where the pirates used the interleaving attack in 
all cases. For the semi-dynamic Tardos scheme we used B = 8 in 
our example. 

Since the scheme is a dynamic traitor tracing scheme, it 
also makes sense to compare it to other dynamic traitor tracing 
schemes from literature. The deterministic scheme of Fiat and 
Tassa from |4] has a codelength of £ — (9(clog2(n)) but an al- 
phabet size of q — 2c +1. In HI, Berkman et al. studied deter- 
ministic schemes with slightly smaller alphabet sizes (q = c+l) 
leading to an algorithm using £ = 0{c-^ + clog2 (n)) symbols, with 
"large hidden constants". Finally, in [9] Tassa investigated a 
probabilistic binary (q = 2) dynamic traitor tracing scheme, but 
his codelengths £ = 0(c^log2(n)ln(n/ei)) are more than a factor 
O(c^) larger than the codelengths of the universal Tardos scheme. 
Furthermore, if we look at other properties of these dynamic 
schemes, we see that the universal Tardos scheme has some nice 
properties. Most of these properties are inherited from the static 
Tardos scheme, and we list some of them below. 



Symbols are always taken from a small alphabet. This is an 
advantage compared to the schemes of Fiat and Tassa lH and 
Berkman et al. [1], which used alphabets of size q = 2c+\ and 
<7 = c + 1 respectively. 



Codewords of users are independent. This means that fram- 
ing a specific user is basically impossible, as the codewords of 
the pirates and the pirate output are independent of the innocent 
users' codewords. Also, a new user can be added to the system 
easily after the codewords of other users have already been gen- 
erated, since the codewords of other users then do not have to be 
updated. 



Codewords positions are independent. In other words, the 
scheme does not make use of the information obtained from pre- 
vious pirate output for generating new symbols for each user 
Therefore the codewords can all be generated in advance, and can 
even be stored at the client side. The security solely depends on 
the marking assumption, so pirates are even allowed to learn the 
values of p,. Furthermore this also allows us to effectively tackle 
semi-dynamic traitor tracing scenarios, as described in SectionlH 
which is impossible for Fiat and Tassa's scheme and Berkman et 
al.'s schemes. Without making changes to their schemes, their 
codelengths would simply increase by a factor B. 



The distribution of watermark symbols is identical for each 
position. This property offers new options, like tracing several 
coalitions simultaneously, using the same traitor tracing code. 
This also means that multiple watermarks from several broadcasts 
can be concatenated and viewed as one long watermark from one 
longer broadcast, allowing one to catch large coalitions with mul- 
tiple watermarked broadcasts. 
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Table 1 : A comparison of the Tardos schemes discussed in this paper. 





static 
(Section|2]i 


dynamic 
(Section[3]l 


semi-dynamic 
(Sectionl4Tni 


semi-dynamic 
(Sectionl4!2]i 


universal 
(Sectionlll) 


scores per user 
density function 
blocks 

guilty caught 
expected codelength 

asymptotic codelength 
example, theoretical codelength 
example, practical codelength 


1 

fico) 

1 of size i 
at least 1 
0(c2ln(n/e,)) 
^c2ln(n/£i) 
109585 
109585 


1 

fM 

£ of size 1 
allc 
0{ccoln{n/£i)) 
^c2ln(«/ei) 
116561 
92000 


1 

/(CO) 

£/B of sizeB 
allc 
O(ccoln(«/ei)) 
^c2ln(«/ei) 
116761 
92000 


1 

/(CO) 
e/B of sizeB 
allc 
O(ccoln(n/ei)) 
^c2ln(«/£i) 
131587 
96000 


CO 

/(CO) 

£ of size 1 
allc 
0(c2ln(n/£i)) 
^c2ln(n/ei) 
148457 
89000 



The codeword generation and accusation algorithm are com- 
putationally and memory-wise efficient. Our scheme does not 
require any complicated data structures, and the only memory 
needed during the broadcast is the scores for each user at that 
time, and the counters t^'-X During the broadcast only simple cal- 
culations are needed: computing Sjj (which has to be calculated 

only once), adding Sji to those scores s'j'^ where c satisfies a cer- 
tain condition, and comparing S^J^^ against Z^'^) . 

Several instances of the scheme with different parameters ei 
can be run simultaneously. For example, by using parameters 
{e|'''} with l^e[''^ < 0.01 and {e{''^} with Ie{'' < 0.05 for two 
different instances of the universal Tardos scheme (using the same 
codewords), a pirate will first cross one of the thresholds associ- 
ated to {Ei}, and only later cross one of the thresholds associated 
to the {ei}. If we use the {ei} for disconnecting users, then even 
before a user is disconnected, we can give some sort of statistic 
to indicate the 'suspiciousness of this user If a user then does 
not cross the highest thresholds, one could still decide whether to 
disconnect him or not. After all, the choice of Ei may be a bit arbi- 
trary, and a user which almost but not quite crosses the thresholds 
Z'"^' is probably guilty as well. 

7 Open problems 

The universal Tardos scheme has two minor drawbacks. First, we 
have to keep multiple scores for each user, namely for each pos- 
sible coalition size c, and secondly, part of the data is disregarded 
for each value of c. To address these issues, one could for exam- 
ple try adjusting the universal Tardos scheme, or start from the 
dynamic Tardos scheme and build a new, c-independent traitor 
tracing scheme. Below we present some ideas, which seem to 
work in practice, but for which rigorously proving soundness and 
completeness seems hard. 

7.1 The queue Tardos scheme 

One possible modification is the following. Instead of using 
"bad" values of pi early on in the broadcast, i.e. using val- 
ues of Pi which are not between 5^'^ and 1 — 5^"^' at positions 
/ e { 1 , . . . , f ^'^ }, we temporarily store those values of p, in queues 



23 : 64 J • • • ' where pj gets stored in queue Qc iff p, G (8 '"^^ , 5 ' ' ] 
or Pi e [1 - 1 - After £(^' positions, for c > 2 we 

then empty the queue Qc+i by using these values as the next val- 
ues of Pi for i e {£<'''> + 1, . . . ,£(^) + \Qc+i\}- Doing this for all 
values of c, we get that all pi, for / e {0, . . . ,£^'^^}, are between 
5'"^' and 1 — 5''^. So instead of disregarding data and using multi- 
ple scores, we can just use the traditional dynamic Tardos scoring 
system on all positions sequentially. This scheme seems to work 
well in practice, but proving soundness and completeness seems 
hard. A further possible drawback is the fact that the pi are now 
no longer universally distributed according to F for each / > 1, 
which makes it harder to efficiently concatenate multiple codes or 
catch multiple coalitions simultaneously. 

7.2 The staircase Tardos scheme 

Similar to the above, one could try abolishing the whole queue- 
system, and simply generate pi according to density functions 
in such a way that the overall distribution on [l,^^'^''] is for 
each c. First, we simply use /''' for / G {I, . . . ,£^^^}. Now 
to get an "average" distribution of /''' on the whole inter- 
val / e {L...,fW} for each c > 2, we use /W = (^(c)/(c) _ 
^(c-i)/^'^^'')/(^''^' "^''^ '■*) the density function for positions 
je {£('^-i) + l,...,£W}, so that ^W/W ^ £(c-i)/(c-i) (^(c) _ 
£(c-i))/(c) poi- c > 3 we see that > for all p, so that 

these functions are indeed proper probability density functions. 
This scheme seems to work in practice as well, but to prove com- 
pleteness seems hard. Using the standard proof method does not 
work here, as for that we need that all pi are generated using the 
density function /('^'. And again, a possible drawback of this 
scheme is that the distribution of the values of pi is not identi- 
cal for each /, and so concatenating multiple codes may not be 
possible anymore. 

7.3 The continuous Tardos scheme 

Looking at Fig. |5] suggests that a continuous threshold function 
Z(/) might also be an option, with Z depending on the position / 
instead of on the possible coalition size c. However, for the proof 
of soundness of the universal Tardos scheme we simply added up 
the error probabilities for each threshold, and by scaling each er- 
ror probability with a factor 1 /c^, the total soundness error prob- 
ability could be bounded by £1. If we use a continuous Z{i) and 
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use this same proof method, we would have to add up 0{c^) of 
these error probabilities, leading to even smaller values of e''' and 
slightly longer codelengths. Theoretically it would be interesting 
to see if such a continuous threshold function is feasible. 

7.4 The ^-ary dynamic Tardos scheme 

Finally, one can try to generalize these results to higher alpha- 
bet sizes q > 2. In this paper we only used the binary alphabet, 
since we could then use the results from Q. One could try to 
give a similar analysis for higher alphabet sizes, possibly by us- 
ing results from [7J. This could lead to even shorter codelengths 
with smaller constants de, although the codelength will still sat- 
isfy 0(c2ln(«/ei)). 
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